From 51382e7c0e0a3543a448c2cd1e6257a1e3c2f0de Mon Sep 17 00:00:00 2001
From: Greg Sutcliffe <fedora@emeraldreverie.org>
Date: Thu, 11 Jun 2026 11:00:48 +0100
Subject: [PATCH] Zabbix: move Nagios moby check

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
---
 .../oci_registry/files/zabbix-selinux.te      | 10 ++++
 .../oci_registry/files/zabbix-template.yml    | 30 ++++++++++
 roles/zabbix/oci_registry/tasks/main.yml      | 60 +++++++++++++++++++
 3 files changed, 100 insertions(+)
 create mode 100644 roles/zabbix/oci_registry/files/zabbix-selinux.te
 create mode 100644 roles/zabbix/oci_registry/files/zabbix-template.yml
 create mode 100644 roles/zabbix/oci_registry/tasks/main.yml

diff --git a/roles/zabbix/oci_registry/files/zabbix-selinux.te b/roles/zabbix/oci_registry/files/zabbix-selinux.te
new file mode 100644
index 0000000000..fb78e86c74
--- /dev/null
+++ b/roles/zabbix/oci_registry/files/zabbix-selinux.te
@@ -0,0 +1,10 @@
+module zabbix_moby 1.1;
+
+require {
+        type zabbix_agent_t;
+        type commplex_main_port_t;
+        class tcp_socket name_connect;
+}
+
+#============= zabbix_agent_t ==============
+allow zabbix_agent_t commplex_main_port_t:tcp_socket name_connect;
diff --git a/roles/zabbix/oci_registry/files/zabbix-template.yml b/roles/zabbix/oci_registry/files/zabbix-template.yml
new file mode 100644
index 0000000000..9102eff1a8
--- /dev/null
+++ b/roles/zabbix/oci_registry/files/zabbix-template.yml
@@ -0,0 +1,30 @@
+zabbix_export:
+  version: '7.0'
+  template_groups:
+    - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec
+      name: Fedora
+  templates:
+    - uuid: 3280a030d5614445998cd4b1b2d63ab4
+      template: 'OCI moby-registry checks'
+      name: 'OCI moby-registry checks'
+      groups:
+        - name: Fedora
+      items:
+        - uuid: 070adeaae331495a91b049795892587d
+          name: http-moby-registry
+          type: ZABBIX_ACTIVE
+          key: 'web.page.regexp[http://127.0.0.1:5000/v2/,,,{}]'
+          delay: 5m
+          value_type: CHAR
+          trends: '0'
+          tags:
+            - tag: application
+              value: oci
+          triggers:
+            - uuid: a5746d1af3284801b94b12633b803641
+              expression: 'last(/OCI moby-registry checks/web.page.regexp[http://127.0.0.1:5000/v2/,,,{}])<>"{}"'
+              name: 'http-moby-register not returning "{}"'
+              priority: AVERAGE
+              tags:
+                - tag: scope
+                  value: availability
diff --git a/roles/zabbix/oci_registry/tasks/main.yml b/roles/zabbix/oci_registry/tasks/main.yml
new file mode 100644
index 0000000000..f4fdb630af
--- /dev/null
+++ b/roles/zabbix/oci_registry/tasks/main.yml
@@ -0,0 +1,60 @@
+---
+# OCI Registry hosts don't have a role of their own to add this to....
+
+# Custom SELinux requirements for Zabbix to make tcp conenction to 5000
+- name: Ensure a directory exists for OCI+Zabbix selinux module
+  ansible.builtin.file:
+    path: /usr/local/share/zabbix
+    state: directory
+    mode: '0755'
+  tags:
+  - selinux
+  - zabbix_agent
+
+- name: Copy OCI Zabbix SELinux module
+  ansible.builtin.copy:
+    src: zabbix-selinux.te
+    dest: /usr/local/share/zabbix/zabbix_moby.te
+    owner: root
+    group: root
+    mode: '0644'
+  register: selinux_zabbix_file
+  tags:
+  - selinux
+  - zabbix_agent
+
+- name: Compile and install SELinux module
+  ansible.builtin.include_tasks: "{{ tasks_path }}/compile-selinux.yml"
+  vars:
+    selinux_module_dir: /usr/local/share/zabbix
+    selinux_module_name: zabbix_moby
+  when: selinux_zabbix_file.changed # noqa: no-handler
+  tags:
+  - selinux
+  - zabbix_agent
+
+- name: Zabbix API Block
+  vars:
+    ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
+    ansible_network_os: "{{ zabbix_network_os }}"
+    ansible_connection: "{{ zabbix_connection }}"
+    ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
+    ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
+    ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
+    ansible_host: "{{ zabbix_server }}"
+    ansible_zabbix_url_path: "{{ zabbix_url_path }}"
+  tags:
+    - zabbix_api
+    - zabbix_agent
+  block:
+    - name: Import OCI Registry Zabbix template file
+      community.zabbix.zabbix_template:
+        template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}"
+        state: present
+      run_once: true
+
+    - name: Add self to OCI template in Zabbix
+      community.zabbix.zabbix_host:
+        host_name: "{{ inventory_hostname }}"
+        link_templates: OCI moby-registry checks
+        force: false